How To Recover Lost, Deleted Or Missing Files And Partitions
1. If TestDisk is not yet installed, it can be downloaded from <a href="http://www.cgsecurity.org/wiki/TestDisk_Download">TestDisk Download</a>. Extract the files from the archive including the sub-directories.<br /><br />2. To recover a lost partition or repair the filesystem from a hard
disk, USB key, Smart Card, etc., you need enough rights to access a
physical device.
<ul>
<li> <img src="dos.png" /> Under DOS, run TestDisk.exe
</li>
<li> <img src="win.png" />
Under Windows, start TestDisk (ie testdisk-6.9/win/testdisk_win.exe)
from an account in the Administrator group. Under Vista, right-click
testdisk_win.exe and then "Run as administrator" to launch TestDisk.
</li>
<li> <img src="linux.png" /> Under Unix/Linux/BSD, you need to be root to run TestDisk (ie. sudo testdisk-6.9/linux/testdisk_static)
</li>
<li> <img src="macosx.png" />
Under MacOSX, if you are not root, TestDisk (ie
testdisk-6.9/darwin/TestDisk) will restart itself using sudo after
confirmation on your part.
</li>
<li> <img src="os2.png" /> Under OS/2, TestDisk doesn't handle a physical device, only a disk image. Sorry.
</li></ul>
3. To recover partition from a media image or repair a filesystem image, run:
<br />
<ul>
<li> testdisk image.dd to create a raw disk image
</li>
<li> testdisk image.E01 to recover files from an Encase EWF image
</li>
<li> testdisk 'image.???' if the Encase image is split into several files.
</li></ul>
4. <img src="linux.png" /> <img src="macosx.png" /> To repair a filesystem not listed by TestDisk, run testdisk device, i.e.
<br />
<ul>
<li> testdisk /dev/mapper/truecrypt0 or testdisk /dev/loop0
to repair the NTFS or FAT32 boot sector files from a TrueCrypt
partition. The same method works with filesystem encrypted with
cryptsetup/dm-crypt/LUKS.
</li>
<li> testdisk /dev/md0 to repair a filesystem on top of a Linux RAID device.
</li></ul>5. Choose Create to instruct Testdisk to create a <a href="http://www.cgsecurity.org/wiki/Log_file">log file</a> containing technical information and messages, unless you have a reason to append data to the <a href="http://www.cgsecurity.org/wiki/Log_file">log</a> or you execute TestDisk from read only media and must create the <a href="http://www.cgsecurity.org/wiki/Log_file">log</a> elsewhere.<br /><br />6. Choose None if you do not want messages and details of the process to be written into a <a href="http://www.cgsecurity.org/wiki/Log_file">log file</a> (useful if for example Testdisk was started from a read-only location).<br /><br />7. Press Enter to proceed.<br /><br />8. All hard drives should be detected and listed with the correct size by TestDisk:<br /><img src="moz-screenshot.png" /><img src="pctech1.gif" /><br />
<ul>
<li> Use up/down arrow keys to select your hard drive with the lost partition/s.
</li>
<li> Press Enter to Proceed.
</li></ul>
<img src="macosx.png" /> If available, use raw device /dev/rdisk* instead of /dev/disk* for faster data transfer.
<br /><br />9. TestDisk displays the partition table types:
<span><img src="Partition_table_type.gif" /></span>
<ul>
<li> Select the partition table type - usually the default value is
the correct one as TestDisk auto-detects the partition table type.
</li>
<li> Press Enter to Proceed.
</li></ul><br />10. TestDisk displays the menus:<br />
<span><img src="Menus.gif" /></span>
<ul>
<li> Use the default menu "Analyse" to check your current partition structure and search for lost partitions.
</li>
<li> Confirm at Analyse with Enter to proceed.
</li></ul>
11. Now, your current partition structure is listed.
Examine your current partition structure for missing partitions and errors:
<br />
<span><img src="Analyse.gif" /></span>
<ul>
<li>The first partition is listed twice which points to a corrupted partition or an invalid partition table entry.</li>
<li>Invalid NTFS boot points to a faulty NTFS boot sector, so it's a corrupted filesystem.</li>
<li>Only one logical partition (label Partition 2) is available in the extended partition.
One logical partition is missing.</li></ul>12. Confirm at <i><b>Quick Search</b></i> to proceed.
<span><img src="Vista_check.gif" /></span>
<ul>
<li> Confirm according to your OS and created partitions to proceed.
</li></ul>13. During the <i><b>Quick Search</b></i>, TestDisk has found two partitions including the missing logical partition labeled <i><b>Partition 3</b></i>.
<a href="http://www.cgsecurity.org/wiki/File:First_results.gif"><img src="First_results.gif" /></a>
<ul>
<li> Highlight this partition and press <i><b>p</b></i> to list your files (to go back to the previous display, press q to Quit).</li>
<li>If all directories and data are correctly listed, Press Enter to proceed.
</li></ul>
14. Save the partition table or search for more partitions?<br />
<span><img src="Search_menu.gif" /></span>
<ul>
<li> <i><b>When all partitions are available</b></i> and data correctly listed, you should go to the menu <b>Write</b> to save the partition structure. The menu Extd Part
gives you the opportunity to decide if the extended partition will use
all available disk space or only the required (minimal) space.
</li>
<li> <i><b>If you are still missing a partition</b></i>, highlight the menu <i><b>Deeper Search</b></i> (if not done automatically already) and press Enter to proceed.
</li></ul>
×